Overview

overview

10

Static

static

3

44e2057c74...97.dll

windows7-x64

10

44e2057c74...97.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44e2057c7466881a61e3b542ce055b3d54aa7d88040ce879a915e20ed996d097

  • Size

    1.7MB

  • Sample

    240410-mrfvlscg63

  • MD5

    f2c89362da39a76b1fc08e1ff6a9a2e9

  • SHA1

    ebaaa5c54d44058a2f24503d8c5a587f7c93e0c5

  • SHA256

    44e2057c7466881a61e3b542ce055b3d54aa7d88040ce879a915e20ed996d097

  • SHA512

    2991e7b9554efdd451b0d9e8a5351bd1da5fbca08803d00aec4a2c6a3b516602e70249c62b1de64bfe497d65512e05f9966d6c8c4a8224dca58a69276b463c34

  • SSDEEP

    24576:3qTLMBPG2jLwPAn3Ow3EliFrxiYMUiWfy17AWIDPXgT1l:3ELo1+gEAFtnMJOy17AWoPQT3

Score
10/10
cobaltstrike1580103824backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

1580103824

C2

http://verofes.com:443/apiv8/getStatus

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    verofes.com,/apiv8/getStatus

  • http_header1

    AAAACgAAABFYLUNsaWVudDogbm90ZXZpbAAAAAcAAAAAAAAAAwAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAABFYLUNsaWVudDogbm90ZXZpbAAAAAcAAAAAAAAADQAAAAUAAAADa2V5AAAABwAAAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    10000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCRhpLz5zd8IwTeaGg6uRpSTHcIB2GGozjmWW5EmiCpa/f3kwlNwNnGn5q6W7unmsML+fh3kap/X7IHPaABhoukG7fYev8J7emKVrRiuIGhEWBKcDXn7L8+LuRY4KfqmRXs79U3eGPm44BC9cbY1Z9svN+81LgSIYBJ8W3ub+x14wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /apiv8/updateConfig

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Edg/96.0.1054.62

  • watermark

    1580103824

Targets

    • Target

      44e2057c7466881a61e3b542ce055b3d54aa7d88040ce879a915e20ed996d097

    • Size

      1.7MB

    • MD5

      f2c89362da39a76b1fc08e1ff6a9a2e9

    • SHA1

      ebaaa5c54d44058a2f24503d8c5a587f7c93e0c5

    • SHA256

      44e2057c7466881a61e3b542ce055b3d54aa7d88040ce879a915e20ed996d097

    • SHA512

      2991e7b9554efdd451b0d9e8a5351bd1da5fbca08803d00aec4a2c6a3b516602e70249c62b1de64bfe497d65512e05f9966d6c8c4a8224dca58a69276b463c34

    • SSDEEP

      24576:3qTLMBPG2jLwPAn3Ow3EliFrxiYMUiWfy17AWIDPXgT1l:3ELo1+gEAFtnMJOy17AWoPQT3

    Score
    10/10
    cobaltstrike1580103824backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks